<?php
defined('ABSPATH') || exit();
final class APEARI_Block_Policy
{
    public const BLOCKS = [
        'core/paragraph',
        'core/heading',
        'core/button',
        'core/buttons',
        'core/group',
        'core/columns',
        'core/column',
        'core/image',
        'core/gallery',
        'core/spacer',
        'core/separator',
        'core/list',
        'core/list-item',
        'core/quote',
    ];

    private static function protected_blocks(array $blocks): array
    {
        $result = [];
        foreach ($blocks as $block) {
            if (
                !in_array($block['blockName'], self::BLOCKS, true) ||
                !empty($block['attrs']['templateLock']) ||
                !empty($block['attrs']['lock']['edit']) ||
                !empty($block['attrs']['metadata']['bindings'])
            ) {
                if ($block['blockName'] || trim($block['innerHTML'])) {
                    $result[] = hash('sha256', serialize_block($block));
                }
            } else {
                array_push($result, ...self::protected_blocks($block['innerBlocks']));
            }
        }
        return $result;
    }

    public static function validate(string $before, string $after)
    {
        if (strlen($after) > 500000 || str_contains($after, '<?')) {
            return self::error();
        }
        $original = parse_blocks($before);
        $next = parse_blocks($after);
        if (self::protected_blocks($original) !== self::protected_blocks($next)) {
            return self::error();
        }
        global $shortcode_tags;
        if ($shortcode_tags) {
            preg_match_all('/' . get_shortcode_regex() . '/s', $before, $old_shortcodes);
            preg_match_all('/' . get_shortcode_regex() . '/s', $after, $new_shortcodes);
            if ($old_shortcodes[0] !== $new_shortcodes[0]) {
                return self::error();
            }
        }
        $existing_images = [];
        $tags = new WP_HTML_Tag_Processor($before);
        while ($tags->next_tag('IMG')) {
            $existing_images[] = $tags->get_attribute('src');
        }
        $walk = static function (array $blocks, int $depth = 0) use (&$walk, $existing_images) {
            if ($depth > 25) {
                return false;
            }
            foreach ($blocks as $block) {
                if (
                    !in_array($block['blockName'], self::BLOCKS, true) ||
                    !empty($block['attrs']['templateLock']) ||
                    !empty($block['attrs']['lock']['edit']) ||
                    !empty($block['attrs']['metadata']['bindings'])
                ) {
                    continue;
                }
                $attrs = $block['attrs'];
                if (
                    !empty($attrs['metadata']['bindings']) ||
                    array_diff(array_keys($attrs), [
                        'align',
                        'anchor',
                        'className',
                        'style',
                        'backgroundColor',
                        'textColor',
                        'gradient',
                        'fontSize',
                        'fontFamily',
                        'layout',
                        'tagName',
                        'templateLock',
                        'lock',
                        'metadata',
                        'level',
                        'textAlign',
                        'ordered',
                        'start',
                        'reversed',
                        'values',
                        'id',
                        'url',
                        'alt',
                        'caption',
                        'sizeSlug',
                        'linkDestination',
                        'linkTarget',
                        'rel',
                        'width',
                        'height',
                        'aspectRatio',
                        'scale',
                        'isStackedOnMobile',
                        'verticalAlignment',
                        'isStackedOnMobile',
                        'columns',
                        'imageCrop',
                        'linkTo',
                        'mediaId',
                        'mediaUrl',
                        'dimRatio',
                        'overlayColor',
                        'minHeight',
                        'minHeightUnit',
                        'contentPosition',
                        'isDark',
                        'size',
                        'ref',
                    ])
                ) {
                    return false;
                }
                if (
                    isset($attrs['tagName']) &&
                    !in_array(
                        $attrs['tagName'],
                        ['div', 'section', 'article', 'aside', 'main', 'header', 'footer'],
                        true,
                    )
                ) {
                    return false;
                }
                $encoded = wp_json_encode($attrs);
                if (
                    preg_match(
                        '~<\s*(?:script|iframe)|<\?|(?:javascript|vbscript)\s*:|expression\s*\(|url\s*\(|@import|data\s*:~i',
                        $encoded,
                    )
                ) {
                    return false;
                }
                $html = $block['innerHTML'];
                $allowed_tags = [
                    'p',
                    'h1',
                    'h2',
                    'h3',
                    'h4',
                    'h5',
                    'h6',
                    'div',
                    'section',
                    'article',
                    'aside',
                    'main',
                    'header',
                    'footer',
                    'figure',
                    'figcaption',
                    'img',
                    'ul',
                    'ol',
                    'li',
                    'blockquote',
                    'cite',
                    'hr',
                    'a',
                    'span',
                    'strong',
                    'b',
                    'em',
                    'i',
                    's',
                    'u',
                    'sub',
                    'sup',
                    'mark',
                    'code',
                    'br',
                    'abbr',
                ];
                $tag_check = new WP_HTML_Tag_Processor($html);
                while ($tag_check->next_tag()) {
                    if (!in_array(strtolower($tag_check->get_tag()), $allowed_tags, true)) {
                        return false;
                    }
                }
                $normal = static fn(string $value) => preg_replace('~\s+/>~', '/>', $value);
                if ($normal(wp_kses_post($html)) !== $normal($html)) {
                    return false;
                }
                $images = new WP_HTML_Tag_Processor($html);
                while ($images->next_tag('IMG')) {
                    $url = $images->get_attribute('src');
                    if (!is_string($url)) {
                        return false;
                    }
                    if (
                        !in_array($url, $existing_images, true) &&
                        !APEARI_Media::existing_url($url, (int) ($attrs['id'] ?? 0))
                    ) {
                        return false;
                    }
                    if ($images->get_attribute('srcset') && !in_array($url, $existing_images, true)) {
                        return false;
                    }
                }
                if (!$walk($block['innerBlocks'], $depth + 1)) {
                    return false;
                }
            }
            return true;
        };
        return $walk($next) ? true : self::error();
    }
    private static function error(): WP_Error
    {
        return new WP_Error(
            'apeari_blocks',
            __(
                'Apeari edytuje tylko bezpieczne bloki Gutenberga i istniejące zdjęcia z biblioteki. HTML, PHP, skrypty, osadzenia i zmiany bloków innych wtyczek są niedostępne.',
                'apeari',
            ),
            ['status' => 422],
        );
    }
}